A vulnerability was found in Ever Traduora up to 0.20.0. It has been declared as problematic. Affected by this vulnerability is an unknown code of the component JWT Signing Key Handler. The manipulation with an unknown input leads to a hard-coded key vulnerability. The CWE definition for the vulnerability is CWE-321. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered. The impact remains unknown. The summary by CVE is:

Ever Traduora 0.20.0 and below is vulnerable to Privilege Escalation due to the use of a hard-coded JWT signing key.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2024-53484 since 11/20/2024. The exploitation appears to be difficult. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

Productinfo

Vendor

• Ever

Name

• Traduora

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

Video

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion